Troubleshooting Tip: Downgrade of FortiOS fails due to BIOS check

If a FortiGate device is running BIOS version 5000100 or 6000100 (or newer), the user will not be able to downgrade to v6.0, v6.2, or any other FortiOS versions below the ones listed here:

• Enhance BIOS-level signature and file integrity checking 6.4.13
• Enhance BIOS-level signature and file integrity checking 7.0.12
• Enhance BIOS-level signature and file integrity checking 7.2.5
• Enhance BIOS-level signature and file integrity checking 7.4.0

The device will not pass traffic and will display this error when booting up:

Booting OS...
Fatal error: Loading FOS fails!
Please power cycle. System halted.

It is recommended to upgrade FortiOS to a version that supports the BIOS security check to maximize the security posture of the device.

If the firmware does not support BIOS-level integrity checks, the BIOS prevents the boot or firmware installation. Refer to Troubleshooting Tip: Error messages 'This Firmware image didn't pass the signature verification.' and 'Firmware upload failed' when attempting to upgrade firmware image for details.

If earlier firmware is required, follow the instructions below to change the BIOS security level and allow the device to load.

Warning:

Changing the BIOS security level affects the overall security posture of the device and network. A lower BIOS security level could allow a user with administrative access to the FortiGate appliance to install and run modified, malicious firmware builds.

1. To change the BIOS security level, ensure a serial console cable is connected and power on the device.
2. When the console displays 'press any key to display configuration menu', press any key.

FortiGate-60F
Ver:05000009
Serial number: FGT60XXXXXXXXXXXXXX
CPU: 1200MHz
Total RAM: 2 GB
Initializing boot device...
Initializing MAC... NP6XLITE#0
Please wait for OS to boot, or press any key to display configuration menu.<-- Press any key.

3. The BIOS configuration menu displays. Press 'I'.
   
   

[C]: Configure TFTP parameters.
[R]: Review TFTP parameters.
[T]: Initiate TFTP firmware transfer.
[F]: Format boot device.
[I]: System information. <-- Select this by pressing 'I'.
[B]: Boot with backup firmware and set as default.
[Q]: Quit menu and continue to boot.
[H]: Display this list of options.

Enter C,R,T,F,I,B,Q,or H:

4. The system information menu displays. Press 'U'.
   
   

[S]: Set serial port baudrate.
[R]: Set restricted mode.
[T]: Set menu timeout.
[U]: Set security level. <- Select this by pressing 'U'.
[I]: Display system information.
[E]: Reset system configuration.
[P]: Normal POST test.
[Q]: Quit this menu.
[H]: Display this list of options.

Enter S,R,T,U,I,E,P,Q,or H:

5. The available security levels are displayed. Enter the desired security level '0'.

[0]: Level 0 - Check image silently
[1]: Level 1 - Check image with result only
[2]: Level 2 - Check image and reinforce validity
Enter security level setting [2]: <-- Provide the digit for the intended security level [0, 1, or 2].

6. After this, follow the menu options to quit the configuration menus and boot the device. Typically, the key sequence is 'Q', then 'Q'.

    

7. The device boots with the updated security level. Earlier firmware versions may now be loaded to the device.

    

8. If upgrading to later firmware versions in the future, it is recommended to set the security level back to 2 after the upgrade.

    

Note:

It is possible to check the security level currently set before rebooting the unit or after changing it with the command 'get system status.'

get system status
Version: FortiGate-60F v6.4.13,build2092,230606 (GA.M)

Security Level: 2
Virus-DB: 92.00663(2024-01-15 04:20)

FortiGates with BIOS version 6.000105 and 6.000106 do not have the option of Security Level 0. In this case, upgrading or downgrading does not work. In such cases, the image to be imported using TFTP interrupts the boot process and loads the configuration from the previous version. More information about importing an image using TFTP: Technical Tip: Formatting and loading FortiGate firmware image using TFTP.

Starting with v7.0.16, v7.2.11, v7.4.6, and v7.6.1, the naming convention for Security Levels has been updated. The previous numerical levels 0, 1, and 2 are now represented as low, low, and high, respectively. More information about this change can be seen in this document: BIOS security Low and High level classification 7.0.16.

FortiGate VM models no longer support changing BIOS security level after upgrade to FortiOS GA builds v7.0.16, v7.2.9, v7.4.4, v7.6.0, or later. The VM BIOS security level is hard-coded to 2 and cannot be changed.

Some units, such as FortiGate 50G, 70G, 90G, 120G, and 200G, and their variants, have a 'Signed Firmware Hardware Switch' that requires physical access to change the BIOS security level (info on how to change it can be found on Technical Tip: How to change BIOS security level on FortiGate G series). If BIOS security level does not appear as an option for a physical device, see the product's datasheet to verify if a device includes this feature.

Related articles:  

Troubleshooting Tip: FortiGate 70G with newer BIOS version fails to boot after downgrade to FortiOS v7.2 

Technical Tip: How to change BIOS security level on FortiGate G series